Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

seeread writes "I discovered how to hack into and secure user accounts of a rising mobile payment start-up. Account info includes credit card details and usage. The company has big name financial backing and an IRL presence, but very few in-house developers, and they don't seem terribly concerned about security. Good samaritan that I am for now, I sent them an e-mail explaining the lapse on their part, but the responses I have received thus far are confused, aloof and unconvinced. So, I am wondering: what is the appropriate next step? Should I do a proof of concept? Should I go to the investors, or should I post about it somewhere? The representatives haven't been too receptive, despite the fact that their brand seems to be at risk, not to mention all of those users' credit cards. I almost feel like it's my responsibility to blow them out of the water if they have made it this far while compromising such trusted data. And although I would love to be in the paper, this hack is just too easy for it to be respectable, though I am sure the FBI could still be interested in all those credit card numbers."

Don't talk about it much publicly. You never know what kind of people there are on the internet and what they could do once they figure out what company you're talking about. Now Slashdot, what are your suggestions to him?

Your personal information could have been used to open fraudulent accounts, as with any other data breach, but they did not lose billing information. In this case, TFQ says billing information is right there for the taking.

I hope that legislatively we will one day regard damaging someone's privacy closer up the chain to damaging their person.

If you "blow it up" you WILL risk very SEVERE consequences. There's no room for the good Samaritan outsider esp. where it concerns security. I'm not sure if there's a reasonable answer that will put a stop to their negligence but I would most definitely tread lightly.

I know what you meant. Believe me businesses will do anything and everything to protect their image with the shareholders. If someone were to leak this to the media, VISA, etc. and the company found out who it was, they'd have their lawyers, and the FBI pounding down that person's door. Go direct to jail, do not pass "go," do not collect $200.

The only way you could possibly approach this from a legal "high-ground" would be to have jurisdiction and sue for negligence.

Except he has already told them about it, so if there was anything in that e-mail that could be used to identify him and then "all of the sudden" they get a breach, guess who's getting a door pounding?

I had to threaten to expose a security flaw which exposed hundreds of thousands of peoples info (luckily no financial info) - within an hour of threatening full disclosure they'd closed my "tech ticket" and an administrator was emailing me for more details and a timeline for a fix.

He is clearly miles and miles in over his head. My advice: STOP. NOW. Don't touch anything and don't say anything. Go read books on ethical hacking and wiretapping / unauthorized access law. He's likely already in violation of several laws, possibly several federal laws. And now he's admitted to them publicly on the internet. -__-

I would second this opinion (also, as above, assuming USA as OP's location). Though your intentions are noble it is highly illegal to breach a computer system without permission/ownership, regardless of intent. Similar to other crimes - you would still be arrested for breaking and entering a property even if your intent was to show the owner that their security system was flawed, unless they asked you to test it out for them.

My advice - do nothing further. You discovered the flaw and told them about it, the onus is on them to make sure that their systems are secure. Just make sure that you don't leave a trail for other, less scrupulous people to follow...you certainly wouldn't want a future breach and malicious use of this flaw to point to you as the one who discovered it!

Not having broken any laws is very unlikely; worse still it may be true locally, but likely he's broken US law and may be extradited or tricked into a situation where they can get him. Later, when he's had a clear statement from the company that he did the right thing, then that's the time to go to the press. Right now, when he's pretty clearly screwed up, he should be in damage limitation mode.

The fact that the company is giving "confused" and "aloof" answers may be just stupidity, but to paranoid me it suggests a trap. They are trying to get him to do something so that they can accuse him of doing something clearly illegal and have the FBI/CIA get rid of him. The fact he's sent an email suggests he's completely screwed unless he's done that through TOR + an anonymizer service.

What to do

Get lawyered up. Lawyers are expensive; not lawyers are much more expensive. Make sure you have one who has actually succeeded in protecting people in your exact situation.

See if the EFF will support you as a security researcher. Freedom of speech issues may help protect you. They may be able to recommend a lawyer. Unless you see martyrdom as your future, be careful not to become a public case until you know that that would be a benefit for you.

Try to find out for sure if you have broken any laws and the consequences. When doing this ensure you only talk to a lawyer (no internet searches!!) so that all discussions remain legally privileged and can't be used against you to show you knew what you were doing / had done

Find a CERT that would be interested in this. Do not communicate further with the company directly, only through the CERT. The EFF might do to. Any body which has real experience in doing disclosure and will isolate you from the risk of direct communication.

Pretending you don't know about the hole would probably have been best, but assume it's too late for that. You need to now go through the notification; until this is fixed you are at risk of lawsuit or prison.

Do not accept any offer of anything; no free travel; no free developer account; no "chance to help us clean up". This is likely an attempt to set you up for an extortion charge.

Anything further you do with this case, you do on your own isolated computer.

Do not do anything which could be interpreted as destruction of evidence. Your lawyer may be able to help you with advice about any data destruction you could do to minimise risk in a lawsuit.

Without legal advice otherwise, do not use any services from the company and don't visit the web site of the company. Beware of anything which might bind you into a contract with the company.

Prepare to be raided. All of your computers will be taken from you and any disks you have on site. Your close family and computer friends may also be raided. Make backups of everything and store them in a locked box somewhere which can't be related back to you. E.g. a trusted but distant friend from school times. Alternatively a vault in a private bank (e.g. in Switzerland).

He's already violated several conditions of the Computer Fraud and Abuse act: conspiracy to access a computer without permission, accessing a computer without permission, including financial records

Maybe. He didn't say he *had* accessed the secure user accounts, just that he had discovered how. Granted that it's usually hard to know if your attack works without testing it, but it is possible to recognize an easily-exploited weakness.

Building a proof of concept doesn't necessarily require accessing the data, either. He could build the proof of concept, test it against his own system, and then send it to them (or perhaps even publish it) without having broken any laws.

So now you're looking at someones account on, let's guess here, Square*... and you KNOW this has to be fixed, it's way too dangerous, but pushing the issue with the company (or elsewhere) could land you in prison.

Agreed. That is a real problem with the way our legal system approaches these issues. Malicious intent really should be a required component of the crime.

A few months ago, I, in the course of my job duties, discovered a massive, glaring, easily exploitable security flaw at a financial transaction processing company that a great many people (as in, somewhere around a third of Americans who pay their bills online) likely use without knowing it. And no, you probably haven't heard of them unless you work in the banking industry.

I didn't write an SQL injection. I didn't guess passwords. I didn't even probe for hidden options in a CGI... I merely mis-typed a path in a web-scraping script intended to retrieve information I legally had the right to get, and ended up with entirely someone else's information. Yes, literally as simple as "tweak the URL", and you could see anyone's info you want.

I informed them of this flaw, as an official "you have to fix this now or consider yourself in violation of our contract" communication, and they have made it a bit better - In that you would now at least need to intend to attack them, rather than just anyone having the ability to do so accidentally. Good to know that no more pesky whitehats will bother them about their insecurities.

But put bluntly, companies don't give two shakes of a rat's ass about us. The very fact that such a trivial weakness existed in the first place demonstrates that they don't pay attention to security in the least; and their fix demonstrates that they don't really care even when they have known flaws. They care about how much it will cost them to fix vs the cost and probability of someone malicious discovering the problem, end of story.

there are plenty of insecure servers out there, we don't need heroes to come along and save us from them.

Seriously.
So if I build a computer at home, and I install an old, unpatched OS for fun, somebody is legally allowed to hack me? The implications of this would be devastating. Even if they aren't vulnerable, businesses could be DDoS'd without recourse on the grounds "we're testing you for vulnerabilities". People simply do not think things through fully.

You can talk with your poker buddies about robbing some bank for 10 years, draw up floor plans, and more... but until somebody saws off a shotgun or gets in a car to go do it, you haven't committed any crimes

If that was the case there'd be no need for a specific offense of conspiracy, since you'd be committing the main offense.

If you hadn't already exposed yourself to the owner, I'd write a how-to and send it to them anonymously, and later send the credit cards an ANONYMOUS tip.

Why anonymous? Hacking, even for white-hat reasons, is illegal in most jurisdictions. Even accidental hacking.

Now that you've exposed yourself to them it would be too easy for them to piece it together who turned them in for a nice PCI audit. It would be all too easy of them to send your emails to a computer crime division and get you busted, especially if they have any friends with influence there. Just avoid using their product and quietly tell your friends not to do the same.

The only time I have ever even considered informing a company of a security hole is on an occasion when I'd previously worked for them, personally knew the owner, and knew that the owner respected my ability.

"How can I help you?"-"Well, I noticed that your bank safe is wide open! You might want to cl-""You asshole! I'm calling the FBI!"-"But people their money might get sto-""Son, you are under arrest for looking at something and then notifying the owner about it"

Lets say you have a company. Lets say you have some servers. Lets say the world works the way YOU say it should.

Now, every day, you're going to get every script kiddie in the internet trying to poke holes in your network. In fact, if they get in, thats fine. They're allowed to look at everything your'e doing (trade secrets) and they can copy user data, since this is legal. You're going to be in hot water with your customers, fast.

Also, you're getting DDoS'd now because of all these people hitting your

I thought about it, and while neither situation is pleasant or nice, I think the GPs idea is still an improvement, and yes should be required by law.

The world you are arguing for is that a company can choose to spend X on security, and when it turns out X=0 and so the chances of them being hacked are 100%, that company then does not have to deal with the consequences of their choice, but instead get to sue the person warning them that X=0 is a bad idea.

For those who are truly interested in testing the boundaries of computer security there are dozens of legitimate companies that do nothing but this type of work. If you know your shit it is also very high paying. If you are truly exceptional any government security or military agency will search out your services under the strategy of "fighting fire with fire". They even accept people who have skirted ot flat out broken the boundaries of law in the past. And the best part is that these type of jobs do not f

While you make a good point that Visa and MC won't sit on their asses about data, that is only from a PCI perspective. And realistically its trivially easy to maintain PCI compliance and have an insecure product.

What I would recommend however is work through a professional service like Secunia: https://secunia.com/company/blog_news/news/271 [secunia.com]. They can lend credibility to your claim and they provide what I personally would describe as an ethical approach to remediation. I would strongly not recommend any further testing on your part unless you are prepared to deal with legal consequences. Not that I agree with companies going after researchers, but it does happen.

I wish that it was possible to mod something up further than 5 in special cases, because the post from hellkyng really is giving the best advice for what you want to do, namely making sure that the people whose data is being stored insecurely becomes stored securely. None of the other 5's in the comments are doing that, they're just "Cover your ass" advice.

Now I'm going to mod up the other post that I've seen which gives advice in line with your goals - contact some famous security professionals and see wh

Maybe the company doesn't care, but the people with money on the line will. And when they start to care, the company will start to care. Don't go hacking to try and prove a point, that's just gonna cause you more trouble than it's worth. And if, at the end of the day, no one cares or does anything about it, no sweat off your back.

If it was me - after the company doesn't bother to recognize it - i'd contact the Credit Card clearing house (Visa/MC/AMex) that they use.. Anyone who is processing and storing CC info has to comply with PCI DSS. If you can get access to card info then they are out of compliance, and are subject to have their merchant account deactivated, charges seized, and pay fines.

The CC companies don't (Normally) play around with it. Contact them and inform them of the situation, IF (AND ONLY IF) they need it provide them a proof of concept CODE/Method only, DO NOT grab card numbers and send them to them as an example, let the CC company evaluate your proof of concept and see if they can access CC numbers.

This method seems to work (has in the past) to get people to fix their holes.. As for them actually becoming a more responsible company after this, well hell never has been a cold place..

You should probably hire a lawyer. It doesn't matter how good you're trying to be. Anything you did to come to your conclusions that was illegal is going to be frowned upon... severely. And if you do go public, you'll likely be hit with a C&D letter.

Exactly. By contacting them, presumably through a non-anonymous email account, you already made a wrong decision. Companies will never admit they were wrong, and if anyone would hack them in the future you will be the first one to blame. Even professional security researchers can be silenced by legal threats, you won't be an exception. Just leave it alone, it's far too risky to rely on a companies goodwill. And if you ever want to do something similar again, the most important part is to remain anonymous th

The most ethical thing you can do is fully disclose the hack to the media, and to as many websites as possible. This will force the developers to either fix the problem or let the company go down in flames. If you keep it secret, innocent pepole will be harmed when their information is leaked by the faulty code. If you could hack it, others can too. They may be less altruistic about what they find.

Write to 2600, call your local media, write to your newspaper, post the info here, go to the forums, and take the word to the street!

It's not only the most ethical, it's the only way this company will actually do anything. I'd also suggest to do this anonymously. Corporations have a habit of striking back blindly in random directions whenever they feel threatened, and this will most certainly threaten them. It wouldn't surprise me in the least if they tried to smack you down with restraining orders, defamation suits, or whatever the lawyers think will hurt you the most. If you release the information anonymously (and be very careful how you go about this), then there's nobody to slap down with restraining orders.

This is the DUMBEST THING EVER. I cannot believe people actually think this way. Are you familiar with the LAW SYSTEM? People can't just go around doing things without permission like that. If your internet connection crosses a state line, (and due to packet routing it probably is and you might not even know) then you are committing a FEDERAL CRIME. That means that not just the police, but the FBI will come knock on your door. History is just FULL of people who though, hey, I'm pretty clever, I'll hack these people and get a job. NOBODY WILL HIRE A CRIMINAL I PROMISE YOU.

Cannot stress this enough. Jeeze.

Here are your options: Call them, email them. Thats it. Move on with your life if they ignore you. There's nothing that says they can't be incompetent if they want to, but there is something that says you can't break into their systems. (yes, even if they're not secured).

If he just shuts up hundreds/thousands of people can be victimized, and I know that in his shoes I would feel bad if that happened. Wouldn't you?

For all he knows, the system he was looking at wasn't as important as he thought, maybe its a testing sever.
Or maybe the company is in the middle of a security audit, and they are paying someone right now to fix things, it just takes time.
We don't know. But the point is, you're not the watchdog of the internet. It isn't your place to go snooping around everybody else's computers. If everybody is allowed to freely trespass on anything, if we abandon the idea of ownership, then there are going to be LOTS o

Yes, you've been pretty emphatic in other posts, but the whole "watch your own ass and screw everyone else" mindset so common throughout this thread bothers me. I'm probably older than you, and certainly grew up in a different cultural environment, and I would have trouble leaving other people hanging in the wind the way that you and a lot of other commenters recommend. Maybe I'm just weird nowdays, but I still tell people when their tail lights are burned out, help kids catch their runaway dog, report a

No, the dumbest thing ever is the legal system which punishes whistleblowers. Wait, no, that's the 2nd dumbest thing ever. The absolute dumbest thing ever are the people who support a legal system that punishes whistleblowers.

If you want to get the word out anonymously, approach a journalist. Journalists have a vested interest in breaking the next scandalous new story, especially those who are new and making a name for themselves. They also have a vested interest in protecting their sources, though you might still want to report it through an anonymous email account.

Ed Felten himself may not be the best person to contact, actually, since he's currently working for the FTC, but then again he may be worth sending an email to.

My point is this: ask someone who is respected in the security field and has years of experience. If not Felten, try and contact Moxie Marlinspike, perhaps.

It sounds like you are young and have very little experience with this kind of stuff. Do not make the mistake of thinking that anyone is going to thank you for your efforts. The company with the bad security may be run by a bunch of technological idiots who will see you as the threat. When the FBI comes calling, they will be more interested in seeing what criminal charges they can bring against you.

But don't be scared into inaction. Instead seek advice from experts who have been in the same position as you. They may have contacts and could help you present the exploit information in a way that is

1) legal2) professionally done3) likely to get taken seriously by the developers at the affected company.

Good luck! As long as you keep certain cautions in mind, you may have just stumbled onto a career in security!

You could consider contacting one of the major credit card companies like Visa. That's assuming you haven't done anything which could be construed as actually testing or exploiting the hole. If you have, it's a pretty sure bet the FBI will be on you like white on rice. They might anyway, but that would be a one way ticket to Club Fed.

As can be concluded from earlier cases like this. Dont tell them anything, dont do anything, but let them have what's coming to them. However, you contacted them. When hacked, they may attempt to sue you. So, you may need to go to a notar or something to have it written that you warned these people, but they didnt take heed or something. You need to have solid documents to show blame may not be laid on you, in courts.

Slashdot has had many stories of well-meaning hackers trying to save companies from themselves, only to wind up being the target of federal and/or state prosecutors rather than being considered a good Samaritan.

Here's my advice:

1) Stop violating federal and state laws. You've just confessed to the world that you are committing federal and state felonies. Stop being a criminal.

2) Walk away while you still can, and maybe you'll still have a life to live free of federal and/or state prosecution.

Stop violating federal and state laws. You've just confessed to the world that you are committing federal and state felonies. Stop being a criminal.

At what point do you become a criminal? By looking at the URL bar and seeing an SQL statement, which can be used for SQL injection attacks? For changing a few characters in the URL bar and seeing that they're sending you other people's credit card numbers? I agree that he should just fuck em and ignore it.

You've sent the email, now send your concerns in writing - hard copy. Set up a meeting with those in charge and explain it in person, nicely. If they do not respond, then let them know that you have no choice but to report the lapse to the appropriate authorities. Under no circumstances, crack your employers service unless they ask for a demonstration.

Personally, I favor the Full Public Diclosure route. You have them a chance, you even told them how to fix it. The shareholders, yes they should know, but its the customers whose accounts are exposed, and the public who may become customers. Don't they really deserve to know what they are signing up for or trusting?

So, you can do a full disclosure.... but they know who you are...its a risk.

Another possibility.... wait a week or a month or so, and then anonymously release it to the public, swear up and down it wasn't you (use tor, etc etc)

Or, you could just leak it into some IRC channels where you can be sure it will be abused.... then come out later with a public disclosure after its found that they had a major breech, include your conversations with them.

Sure you could just walk away but.... don't the customers really deserve to know? They are paying for the service afterall.

And not just in the tech world. You can be sued if you do CPR and crack someone's ribs if you're not certified. You can be prosecuted for going on someone's property if you hear screaming coming from the house. You can be prosecuted if you shoot an invader in your house (at least in the UK).

There's no use in being a "good guy" anymore. Just trying to help someone will get you in trouble anymore. If you're a guy and talk to a kid you don't know, everyone gives you strange looks. A while back a kid was trying to put books into one of those big metal boxes libraries have for returns, but couldn't quite reach the handle to open it. I opened it for him, and his mom, who was sitting in the car at the curb gets out and starts trotting at us. Books go in, he starts walking back, and she is giving me the evil eye while she grabs the kid and nearly drags him back to the car. All the while I'm holding my own books.

I'm inclined to agree with those who state this was a honey pot. Maybe it was and maybe it wasn't, but standard security procedure is to have a honey pot open and available for naive, young hackers to fall into. You probably aren't the first person in it, either, if this is a big name institution. I read that an unsecured computer left open to the Internet will have hundreds of attacks compromise it a day, within seconds of going online. So, I would guess those credit card numbers are also fake.

Your best bet is to leave it alone. If this isn't a trap, that's for the company and the customers to deal with it, and the repercussions that follow. The fact that you need to ask here what to do about it leads me to suspect that you are in over your head.

"Hacking is hacking into remote targets. Cracking is cracking software on your local computer by reverse engineering and debugging it."

Absolutely wrong. "Hacker" is defined, and differentiated from "cracker," in RFC 1392 [ietf.org]:

cracker
A cracker is an individual who attempts to access computer systems
without authorization. These individuals are often malicious, as
opposed to hackers, and have many means at their disposal for
breaking into a system...

hacker
A person who delights in having an intimate understanding of the
internal workings of a system, computers and computer networks in
particular. The term is often misused in a pejorative context,
where "cracker" would be the correct term.

*sigh* man, I feel you. The word "hack" is just gone, lost from our culture. The mainstream has twisted it far too much.

Reading Aaron Barr from HBGary talk to anonymous and then talk to his "programmer" about all his sweet "hacks" nearly killed me.
The 95 Hackers film has become reality. I can't shake em, he's right behind me! Crash overdrive! Acid Burn!

Ooh, plus there's Swordfish "dropped a logic bomb through the trapdoor" and the wonderful CSI "programmed a GUI interface in Visual Basic to track the IP".

We really need to start educating the non-technical public on some technical things. Treating computers and technology as a whole as a black box ends up in all KINDS of misunderstandings and misinterpretations.

Are you implying that security related research is not legitimate? Or that this guy's attempts to warn the company about their problems are a black-hat thing? Because it sure sounds like you just called this guy a "cracker" for analyzing and then disclosing a security vulnerability. Is that really what you meant?

I hear it used all the time. In phrases like 'password cracking' or 'WEP cracking'. It doesn't sound right to say hacking WEP or password hacking. For something like a website the term 'hacking' just sounds better than cracking. Maybe its an association of the word cracking with safe cracking. So it sounds more natural when referring to some kind of code that is being broken.

Dress it up how you want to, you're still a criminal - legally, morally, and ethically, it's none of your business, you shouldn't have done it in the first place, and quit doing it in general.

its maybe none of his business, but its MY business AS A USER that some company that i give my credit card to is this irresponsible. Those who would hack it, would hack it, and just use the cards and deduce hard to notice amounts every month and fuck me over.

if it wasnt for people like the article submitter, THOSE COMPANIES WOULDNT LIFT THEIR ASSES for security. so YOU shut the fuck up. its MY wallet.

As a user of this business, you're allowed to hack into their systems and make all the changes you want, you can inspect everything they do, because you paid for their service! EXCEPT THAT ISN'T HOW IT WORKS ANYWHERE, OR HOW IT HAS EVER WORKED. WHAT ARE YOU THINKING?

Fine. Are you going to bail the submitter out of jail when the Feds come looking for him? Are you going to finance his legal defense fund? Are you going to hire him once he's finally released from jail?

I completely agree with you that in an ideal world, filled with unicorns and rainbows and ponies and warm, happy, fuzzy thoughts that the right, ethical thing to do would be to do whatever you can to alert people to security holes so that users' don't get screwed over by the real black hats (of course,

You're being a bit harsh on the guy. A lot of people started their IT careers in the computer underground, myself included. If it were not for LA 2600 meetings and the first few Defcons, I would not have developed the skills and background that landed me my first job as a sysadmin fifteen years ago. More recently (within the last year), the head auditor for my company told me that my background reassured him because he knew that I had a better perspective on computer security and the threat landscape than most "professionals" who picked up all of their knowledge in a classroom.

WRT the OP, it was dumb for him to go to the company. As everyone else stated, he exposed himself to some liability. Any information that he provides to the company could be used to build a case against him for computer trespass, unauthorized access, etc.

To call the OP morally and ethically criminal is overboard. He did not do any damage to them and did not profit from his activities. It was a real world learning exercise. It was not the brightest move in the world, but doing a security audit on a random computer system does not make someone morally bankrupt. If he had taken the data and sold it for profit, or even just posted it for fame and notoriety, that would be a different story. Instead he naively did "the right thing" without fully understanding the liability it exposed him to.

What the OP did is no different than what you or I did. The environment is different due to the criminal statues on the books and the willingness of the authorities to prosecute them. Other than that, it is just a kid / young adult pushing the boundries and seeing what they can get away with.

Given that the OP had the good sense to post here and ask for guidance shows that they have their head on mostly straight. The phone phreaking that you did was more objectionable than what the OP did. You stole services. The OP just found a flaw, reported it and then realized that the vendor had no interest in taking the problem seriously. By doing that, they are exposing their customers to fraud.

I agree with you about needing to emphasize ethics. I think the OP has shown ethics and a conscious awareness of responsible disclosure. Back in the day, the exploit would have been all over various underground forums, and everyone and their mom would be poking around the site.

I don't care if you're not doing it for money (though, you sound like you might do it for fame). It's wrong.

As he explained it, it sounds as if he's concerned about the outfit's customers.
It's not unheard of -- that people care about the wellbeing of other people.
(That Christ guy you mention in the subject line did, for example)

Jesus Christ got crucified too, and that's a serious risk for this guy as well. In the metaphorical sense, true, but it could still get pretty unpleasant. He really should quit tresspassing because it does not improve the disclosure, is no longer needed and finally, provides anyone who knows about it with a pretty big lever against him to shut him up. Don't give them more ammo than they already have.

How long do you think it will be now before the blackhats start looking at the payment handling processes of 'a rising mobile payment start-up' with 'big-name financial backing' ?I don't think there are too many companies that match your description..

No need to search to hard for the company. Our illustrious OP, aka Mr. Christopher Reed (http://seeread.info/) was naive enough to post this on twitter (http://twitter.com/#!/seereadnow)."@TheLevelUp I think I found a trivial way to hack user accounts. Please get in touch to resolve."

At least he can point to the twitter feed as evidence that he was trying to contact them. This/. article where he considers "blowing them out of the water" would undoubtedly work against him though.